General
- Target 2026-08-20_8f3dca718f1e28087c8e2982e00e4ec8_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
- Size 4.2MB
- Sample260820-1gre9awarb
- SHA256 69405a01beccc6202b48e1a66062a8a7a2f5cbe9479bdbc767cfbf0c95d4de2b
- MD5 8f3dca718f1e28087c8e2982e00e4ec8
- SHA1 cb8922b47d0e50efe1bfe78ae4c4b412e3bd24a6
- SHA512 8233420fb73c70d8943f21a323a64e699ac7f64424ad0481c6e32489e462901baca202fda20305744eadf0569f8ad43296369b247e459fc483832e7dd4f4fc44
- SSDEEP 24576:oJfOYBICEyX3AKJV+PIRPplGhi8XvooLgtLM/VwR2WF73JprrxsuzAgjqWOhzNcs:oJfPBdENKH+QRPTIyIf
- TLSH T1BB16AE7A7C541CE6E16F5237C966A8D423717C224F9663CB14A0B7AA0E737E1ED31B08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_8f3dca718f1e28087c8e2982e00e4ec8_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_8f3dca718f1e28087c8e2982e00e4ec8_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_8f3dca718f1e28087c8e2982e00e4ec8_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
- Size 4.2MB
- SHA256 69405a01beccc6202b48e1a66062a8a7a2f5cbe9479bdbc767cfbf0c95d4de2b
- MD5 8f3dca718f1e28087c8e2982e00e4ec8
- SHA1 cb8922b47d0e50efe1bfe78ae4c4b412e3bd24a6
- SHA512 8233420fb73c70d8943f21a323a64e699ac7f64424ad0481c6e32489e462901baca202fda20305744eadf0569f8ad43296369b247e459fc483832e7dd4f4fc44
- SSDEEP 24576:oJfOYBICEyX3AKJV+PIRPplGhi8XvooLgtLM/VwR2WF73JprrxsuzAgjqWOhzNcs:oJfPBdENKH+QRPTIyIf
- TLSH T1BB16AE7A7C541CE6E16F5237C966A8D423717C224F9663CB14A0B7AA0E737E1ED31B08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.